[PATCH] KVM: MMU: kvm_mmu_put_page() only removes one link to the page

...  and so must not free it unconditionally.

Move the freeing to kvm_mmu_zap_page().

Signed-off-by: Avi Kivity <avi@qumranet.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
index 7e20dbf4f84cf7e1644f8234a287ac3f6fb7627f..d788866d5a6f832fb43c3c407cd912a2d2a27fea 100644 (file)
--- a/drivers/kvm/mmu.c
+++ b/drivers/kvm/mmu.c
@@ -521,10 +521,6 @@ static void kvm_mmu_put_page(struct kvm_vcpu *vcpu,
                             u64 *parent_pte)
 {
        mmu_page_remove_parent_pte(page, parent_pte);
-       kvm_mmu_page_unlink_children(vcpu, page);
-       hlist_del(&page->hash_link);
-       list_del(&page->link);
-       list_add(&page->link, &vcpu->free_pages);
 }
 
 static void kvm_mmu_zap_page(struct kvm_vcpu *vcpu,
@@ -546,6 +542,10 @@ static void kvm_mmu_zap_page(struct kvm_vcpu *vcpu,
                kvm_mmu_put_page(vcpu, page, parent_pte);
                *parent_pte = 0;
        }
+       kvm_mmu_page_unlink_children(vcpu, page);
+       hlist_del(&page->hash_link);
+       list_del(&page->link);
+       list_add(&page->link, &vcpu->free_pages);
 }
 
 static int kvm_mmu_unprotect_page(struct kvm_vcpu *vcpu, gfn_t gfn)